OpenFlow Instance with TLS -- how to create Certificate for OpenFlow?

[RGBD]

I get this error when trying to configure my OF instance on PV 3800 (KA_15_14):

3800B(config)# openflow instance vpatch controller-id 1 secure
Certificate for OpenFlow is not configured.
3800B(config)#

I tried to create self-signed cert from the web UI, but no luck.

Does anyone have the process for creating/getting the correct cert and installing?

The config guide just says you need one and is not specific on how to configure it.

[EricAtHP]

First, if you are using the HP controller, the certificate used on the switch must be the signed by the same CA as the cert on the controller. So a self-signed cert won't work.

To install a CA signed cert on a provision based switch:

• Set the time correctly (either manually or with SNTP/Timep)
• Configure the identity of the switche with "crypto pki identity-profile"
• Generate a CSR with "crypto pki create-csr" make sure you use the "usage" option in the command and specify "all" or "openflow"
• Then take the CSR to a CA of your choice
• Install the resulting certificate onto the switch with "crypto pki install-signed-certificate"

These commands are just the beginning of the command, use tab or ? to complete the command.

Hope that helps.

[sdnindia]

Hello,

Just following up to see if the previous post answers your query.

Please feel free to reply incase you have more questions around the same topic or open a new thread if new  topic.
If you feel we have answered your question, please do let us know by marking this response as an 'accepted solution’.

Thanks
HP SDN Team